Free tool
Paste a docker-compose.yml. Get a plain-English explanation of every setting, warnings for risky ones, and a diagram of how your services connect. Parsed in your browser — nothing is uploaded.
Parsed in your browser. Nothing is uploaded.
3 services defined: proxy, app, db.
Declares 1 named volume: pgdata. Their data survives docker compose down unless you add -v.
Runs the image nginx:1.27-alpine.
Restarts if it stops or after a daemon restart (unless-stopped), but stays down if you stopped it manually.
Publishes: host port 80 forwards to container port 80, on all network interfaces.
This service starts after: app (waits only until it has started, not until it is ready).
Builds the image from the Dockerfile in ..
Restarts if it stops or after a daemon restart (unless-stopped), but stays down if you stopped it manually.
Sets 2 environment variables: DATABASE_URL=postgres://app:••••••@db:5432/app, NODE_ENV=production.
This service starts after: db (waits until it is healthy).
Runs the image postgres:16.4.
Restarts if it stops or after a daemon restart (unless-stopped), but stays down if you stopped it manually.
Sets 3 environment variables: POSTGRES_USER=app, POSTGRES_PASSWORD=••••••, POSTGRES_DB=app.
Publishes: host port 5432 forwards to container port 5432, only on 127.0.0.1.
Mounts: named volume pgdata is mounted at /var/lib/postgresql/data.
Runs pg_isready -U app -d app to check the container is healthy every 10s (timeout 5s, 5 retries).
In short: paste a compose file and this page explains each key using your real values, flags common security mistakes such as privileged containers and databases published on every interface, and draws the service graph. It runs entirely in your browser.
A compose file describes an application as a set of containers. The parts you will see most:
These are the settings the explainer warns about most often, with the safer alternative for each:
No. The file is parsed and analysed in your browser with JavaScript. Nothing is sent to a server, and there is no AI call in this tool.
The Compose Specification, which is what docker compose v2 uses. The top-level version: key is obsolete and ignored, so older v2/v3 files still parse.
No. It only reads the YAML. It never pulls images, starts containers or contacts a Docker daemon.
Warnings come from a checklist of 14 common misconfigurations: privileged mode, docker.sock mounts, pid: host, dangerous cap_add entries, host networking, hardcoded secrets, sensitive bind mounts, unconfined seccomp/AppArmor, datastores exposed on all interfaces, running as root, :latest image tags, and missing healthchecks, restart policies or resource limits. It is a quick checklist, not a full audit. To review your whole repository — code, secrets and infrastructure config — run a full OpenRouting scan.
Yes. The service diagram can be exported as SVG or PNG.
No. It analyses the single file you paste and shows ${VAR} references as written. It does not read .env, follow extends or include, or merge override files.
OpenRouting scans your whole repository — code, secrets and infrastructure config — and its review agents explain each real finding and suggest a fix.
Get started free